My head is still spinning. Over the past two days (in addition to learning that Windows honcho Terry Myerson is leaving, and the Windows team is being
[See the full post at: Sorting through the Patch Thursday and Friday offerings]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
Sorting through the Patch Thursday and Friday offerings
- This topic has 56 replies, 32 voices, and was last updated 5 years, 2 months ago.
AuthorViewing 22 reply threadsAuthor-
My head is still spinning. Over the past two days (in addition to learning that Windows honcho Terry Myerson is leaving, and the Windows team is being[See the full post at: Sorting through the Patch Thursday and Friday offerings]
Thanks for the update Woody. I hope when the dust settles, you’ll be able to provide a complete list of what Windows 7 patches need to be installed, and the correct order in which to install them.
2 users thanked author for this post.
-
Yeah. I’m not looking forward to that.
1 user thanked author for this post.
-
Yeah. I’m not looking forward to that.
I’m sure you aren’t, but based on Susan “Patch Lady” Bradley’s latest post, it looks like we’re going to need that list sooner rather than later.
Should Windows 7 x64 users like myself:
1. Run the pre-4088875 script
2. Install KB4088875
3. Install KB4100480Or should we just install KB4100480 and hope that April’s rollup resolves the other issues? Or do something else entirely? Inquiring minds need to know! And need to know now!
Thank you in advance for your guidance.
1 user thanked author for this post.
-
-
-
Alpha128….my exact thoughts as well. There is no way I can make sense out of the Win7 updates on my own. Right now, I have not idea what should be installed and in what order or do we just hide all March patches and wait for a better April.
We’re counting on you, Woody!!!!
1 user thanked author for this post.
-
-
I didn’t necessarily recommend to install KB4100480 now, but I mentioned that I already did, and that Microsoft recommends in all affected KB articles that those with the affected updates install KB4100480 “immediately” (example).
If you’ve already installed KB4100480 and aren’t having issues, I recommend to leave it installed.
-
I have installed it as well because… well, i’m not sure why but it seemed a better plan than extracting the two security only patches i’ve already installed (january & february), given that it supposedly only contained a small subset of the broken march updates. Also that ulf fellow seemed to know what he was talking about so here we are. I’m not having any problems as yet but after reading today’s posts now i’m not so sure it was wise to do so.
I think it should also be mentioned that those who just install security only updates won’t be offered KB4100480 through windows update but will have to get if from the catalog.
1 user thanked author for this post.
I’ve simply uninstalled all 2018 OS security updates from my win7 boxes – I may be done with MS updates, period.
1 user thanked author for this post.
-
What a complete clusterfunction.
mulletback, I’ve decided on the same approach– I’m done feeding my Win 7 boxes the Microsoft dogfood updates. It’s been a non-stop carnival show this year. The cure is worse than the disease. I’ll continue to patch my Win 8.1 boxes as those seem to fair a bit better.
Thanks for the headaches, Satya. You owe me some painkillers.
1 user thanked author for this post.
-
@ghz I would highly recommend that you do not install any march patches whether important, recommended, checked or unchecked or any in the Catalog until Woody and the resident experts have fully tested and have definitive results.
Just keep your antivirus software up-to-date and check in here now and again for the update walkthrough on updating your system.
In this current patching climate, it pays to wait.
Keeping IT Lean, Clean and Mean! -
“Many folks were wondering how this patch stacks up with all of the (many!) other problems we’ve seen with this month’s Win7 Monthly Rollup and Security-only patches. The Folks Who Know Such Things now say that this patch does, indeed, introduce all of those problems — the SMB server memory leak that brings down servers, random re-assignment of static IP addresses, and three separately triggered bluescreens.”
It’s possible that KB4100480 might introduce some or all of the issues that KB4088875 or KB4088878 have to computers that don’t already have KB4088875 or KB4088878 installed because KB4100480 installs some of the files in KB4088875 or KB4088878. However, KB4100480 doesn’t necessarily have all of the issues that KB4088875 or KB4088878 have for computers that don’t already have KB4088875 or KB4088878 installed because KB4100480 doesn’t install every file in KB4088875 or KB4088878. Example: KB4100480 doesn’t install pci.sys according to this list of files in KB4100480, therefore KB4100480 might not introduce the networking issues that KB4088875 or KB4088878 have.
-
@Mr.Brian: I installed the KB4100480 yesterday, as advised, and have had no problems as yet. I had two of the “time bomb updates” installed and as directions were to install the KB4100480 I proceeded to do so with no adverse effects (as of now). Thank you once again for your advice in dealing with this mess. 🙂
“Ulf Frisk, the guy who discovered this gaping security hole (where a program can read or write data essentially everywhere on Intel PCs running 64-bit Win7/Server 2008R2), said on Wednesday that this month’s Monthly Rollup fixes the hole. The next day he said that, oops, this month’s Monthly Rollup doesn’t fix the hole and Microsoft revealed that, uh, this month’s Monthly Rollup actually introduces the hole.”
The January and February 2018 updates listed at https://support.microsoft.com/en-us/help/4100480/windows-kernel-update-for-cve-2018-1038 also have the Total Meltdown vulnerability.
5 users thanked author for this post.
-
That sounded a bit odd to me too.
All in all, patching has not presented a good face for Microsoft so far in 2018.
That being said, and in an interest to provide balance, the chief engineer at my company – who runs macOS on an iMac and Windows 7 in a VMware Virtual Machine to do his Windows development – some time ago decided to keep his Windows 7 system on 100% Microsoft-supplied Windows Update settings (i.e., automatic group A). He tells me that so far he’s had no problems with it whatsoever. Of course, he makes good backups and he has VMware snapshots, so if he does have a problem – even a bad one – there’s an easy, quick fix to get his working environment back to working. Maybe the presence of the safety nets averts problems (Murphy’s law). And to be fair he does use his virtual Windows system in a limited way – e.g., he runs Visual Studio in Windows, but browses the web and does eMail, Skype, etc. using his native macOS environment directly.
-Noel
-
-
That’s entirely possible – and very troubling.
8 users thanked author for this post.
-
-
-
-
Or maybe we can hope for a course change when leadership changes. Many feel the course Microsoft is now on isn’t the right one.
I guess the question in my mind is: Can a new leader come in who resets the path of Windows back to the straight and narrow?
One way to think about it might be to imagine mothballing the current code base for Windows 10, resurrect the code base for Windows 7, very carefully port select architecture changes to it from Windows 10, then move it in the direction it was going back in the early 2010s. Call it “Windows for Serious Computing” or “Windows as an Operating System” or maybe just “Windows 7.2” (who wouldn’t buy that?).
It won’t be quick – but that’s okay – we don’t need quick, we need stable/useful! It’s an operating system. The stable foundation for things that change more rapidly.
Microsoft has always been an adept manager of mediocrity – possibly the best on the planet. They have turned “needing to stay tied to Microsoft because of the problems they themselves created” into an art form. But there’s really only so far they can go with that. At some point things have to actually work.
-Noel
10 users thanked author for this post.
-
@Noel – The current monthly patching debacles is probably forcing more serious searching for alternatives, which do exist. For many, any OS will do just fine given what they use a computer for so a Chromebook, Mac, or a Linux distro is a reasonable alternative (listed in order I think users will adopt). Those who have a key Windows only application may be able to run it in a VM but mileage will definitely vary. MS is creating a serious opportunity for others to step and provide a solid, stable OS that lacks the drama of the monthly patching.
1 user thanked author for this post.
-
Windows Patching DEFCON:
The Only Winning Move Is Not To Play!
4 users thanked author for this post.
-
Fail-safe
1 user thanked author for this post.
I’m Group B Win 7 x64 current on IE11 and security only patches through February.
I’m trying to decide whether to install KB4100480. So, I’m wondering just how likely it is for the security hole this KB patches to be exploited. Apparently, this hole is easy to exploit, but does an attacker need to have physical access to my machine. Or can the hole be exploited by malware? Or is their some other way the exploit can occur?
What I’m getting at is if my machine is physically safe and I’ve got up to date MS Security Essentials and am a very conservative web surfer (no ads and only a handful of sites – gmail, askwoody and a couple of bank/financial sites), then just how susceptible am I – and also the handful of retired folks I help with patches?
Installing KB4100480 seems to come with a set of unknown problems, some or all of which have been found in the March patches, so if I’m in a pretty safe position, I’d really rather not install it yet. I’d also rather not rollback to December, not only because of the hassle factor, but because there were, I think, holes other than Meltdown and Spectre that were patched in January and February.
Maybe other folks here are in a similar situation. So I’d be interested in what some of our experts (MVPs and others) think.
Thanks.
1 user thanked author for this post.
-
I installed KB4100480 and rebooted the computer. The system booted without error.
The patch appears not to have borked my system.
Carpe Diem {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1778 x64 i5-9400 RAM16GB HDD Firefox115.0b2 MicrosoftDefender -
The Total Meltdown vulnerability (fixed by KB4100480) can be used by malware to elevate privileges. I don’t know if the Total Meltdown vulnerability can be exploited via JavaScript delivered in a web page to a web browser.
2 users thanked author for this post.
-
Javascript in a web browser can exploit TotalMeltdown, and no fancy timing is required since any program, script or code has access to all kernel and program memory. This is why TotalMeltdown is unbelievably severe. Any program or script can exploit TotalMeltdown. No malware techniques whatsoever are required.
-
Do you have a source for that? It is very scary to think javascript could be used to easily read and write any part of memory. If it is that easy, why don’t we see a lot of malware exploiting that in the field?
1 user thanked author for this post.
-
-
Okay, we have two Win 7 64 bit computers and two Windows 7 32 bit computers.
KB4100480 is described as a fix for 64 bit computers. Does this mean I skip it on the two 32 bit computers?
At this point, I’m ready to remove January’s and February’s security only updates. I am not close to doing anything with the March mess.
I do make images so if I notice something unusual, I’ll restore a late December image.
Got coffee?
1 user thanked author for this post.
A couple of short points here. First, take a breath people. This is a massive screw up that is more damaging to Microsoft’s bottom line than causing any problems to your personal PC. Yes, if not fixed, then these ‘holes’ could maybe in the future lead to easy exploits. But the odds that causal users will be hit are small. My advice is simple. Make sure your AV programs are up to date, your browser the latest version and sit tight. And for goodness sake, listen to Woody, Susan, and the MVP’s here and you will be OK. Relax. There is no need to panic yet. Second point. Susan has every reason to be angry. Small and medium size business are going to bare the brunt of this major failure on Microsoft’s part. I don’t care how Satya spins this, he is done. No CEO survives the kind of rolling mistakes that puts a major 500 on the block. The reason Microsoft has been successful is that up to now, they have had one of the best ‘fix it’ organizations on the planet, backed up by one of the finest Q and A division anywhere. To put it plainly, even if Microsoft’s OS or programs were utter c**. They would make every effort to either fix, or upgrade said piece of software for their clients, and in most cases do it free. That was not only part of Microsoft’s written contract language, it was at the core of what they did as a company. That’s mostly gone now, Satya’s wiped it out. The bulk of business in the United States, and around the world are mom and pop outfits who either have to do their own, or hire someone like Susan Bradley to handle their back end operations. Think about it. Satya has though his own high handedness, put many of these small companies at serious risk of a breach. Not their fault. They trusted a major vendor who up till now has held up the end of their deal. (Went a little longer than I thought. Sorry about that.)
10 users thanked author for this post.
I’m on Windows 8.1, but not crowing at all. I really feel for those on Windows 7, because these problems aren’t your fault, they’re Microsoft’s. If this is another scam to con Win 7 users to upgrade to Win 10, then it’s totally wrong. Since Microsoft abandoned Win 8.1 for the enterprise, they don’t care if we upgrade. With more users still on Win 7, they’re a target. I don’t trust Nadella, since he cares about the cloud more than the desktop.
Bought a refurbished Windows 10 64-bit, currently updated to 22H2. Have broke the AC adapter cord going to the 8.1 machine, but before that, coaxed it into charging. Need to buy new adapter if wish to continue using it.
Wild Bill Rides Again...It’s possible that KB4100480 might introduce some or all of the issues that KB4088875 or KB4088878 have to computers that don’t already have KB4088875 or KB4088878 installed because KB4100480 installs some of the files in KB4088875 or KB4088878. However, KB4100480 doesn’t necessarily have all of the issues that KB4088875 or KB4088878 have for computers that don’t already have KB4088875 or KB4088878 installed because KB4100480 doesn’t install every file in KB4088875 or KB4088878. Example: KB4100480 doesn’t install pci.sys according to this list of files in KB4100480, therefore KB4100480 might not introduce the networking issues that KB4088875 or KB4088878 have.
OMG I got a headache trying to sort out the logical chain in this paragraph. There’s a tongue-twister feel to it.
Reminds me of the old poster that read:
I know that you believe that you understood what you think I said, but I am not sure you realize that what you heard is not what I meant.
No fault of @MrBrian, it’s the nature of the MS beast.
-
In case you missed it, please read this post.
5 users thanked author for this post.
-
Thanks, @mrbrian. When I visit Woody’s I tend to open the comments threads starting from the top (most recent blog post) in the Home section, so it would have been a while before I saw your referenced post which came in since the last time I went into that thread.
The situation with those updates is much clearer now.
1 user thanked author for this post.
-
Same experience, guess I didn’t want to be first to admit it. Very willing to support the person who stepped up and did. I see MrBrian has already given the link I came to add, where he breaks it apart much better, and with full supporting argument.
But on this first, short, inline circulating logic path: first my eyes rolled and would not focus, then I squinted and tried again, I was sure I read it wrong, then I suspected MrBrian typed it wrong, on the fifth try it clicked, and after six strokes at the ball I picked it up and walked away. I understood it, but wondered how many times MrBrian reread it before posting.
Both the original twister, and your old glossy wall poster gave a good giggle. Thanks.
3 users thanked author for this post.
-
Oh this is wonderful! Installing MS’ patches on Windows 7 PCs is getting more and more reminiscent of a film sequence from The Matrix.
1 user thanked author for this post.
My head is still spinning. Over the past two days (in addition to learning that Windows honcho Terry Myerson is leaving, and the Windows team is being[See the full post at: Sorting through the Patch Thursday and Friday offerings]
Does anyone besides me think that it might be time to consider a class-action lawsuit against Microsoft over this interminable patching mess? I’m not an attorney, but isn’t there at minimum an implied contract between Microsoft and its users to, in good faith, support specific products up to a specific date, i.e. Windows 7, through mid-2020? And wouldn’t that good-faith support have to be at the very least reasonably competent, i.e. actually improve the product I’m patching and not damage it or further weaken my protection against cyber attack? And wouldn’t it be easy to show there have been many instances where it has not been? And haven’t many of us suffered real, provable damages from Microsoft’s long history of incompetent and irresponsible handling of security and product patching? For instance: If I can document–as I can–that I have recently had to spend seven hours uninstalling an admittedly botched Microsoft patch, am I not entitled to be compensated at my hourly rate for the time required to fix Microsoft’s admitted error? And hasn’t Microsoft put thousands, if not hundreds of thousands, if not millions, of people in this same predicament? And mightn’t that amount to billions of dollars? And wouldn’t a percentage of those billions make a worthwhile payoff for a law firm willing to take something like this on? Should my clients have to pay for Microsoft’s incompetence? Am I and my clients not entitled to a minimum of respect? Am I obliged to simply take this kind of treatment endlessly without recourse, accountability, or the ability to petition to have my grievances recognized and addressed?
Just askin’.
GaryK
1 user thanked author for this post.
[…]And wouldn’t a percentage of those billions make a worthwhile payoff for a law firm willing to take something like this on?[…]
Ah, therein lies the problem. Even assuming that a class-action lawsuit goes forth and succeeds, the lawyers will get hundreds of million$ and you and I will each get a check for $2.50. Or better yet, we’ll receive “compensation” in the form of a credit for the purchase of future Microsoft products and services.
Microsoft may be punished, but the amounts that MS customers themselves get will be trivial, when not downright insulting.
All very good questions that you ask, BTW.
1 user thanked author for this post.
[…]And wouldn’t a percentage of those billions make a worthwhile payoff for a law firm willing to take something like this on?[…]
Ah, therein lies the problem. Even assuming that a class-action lawsuit goes forth and succeeds, the lawyers will get hundreds of million$ and you and I will each get a check for $2.50. Or better yet, we’ll receive “compensation” in the form of a credit for the purchase of future Microsoft products and services. Microsoft may be punished, but the amounts that MS customers themselves get will be trivial, when not downright insulting. All very good questions that you ask, BTW.
Going by past experience, you are doubtless correct that we’d get pennies while the attorneys would reap the real rewards, but I’m trying to frame the questions in a way that might interest an attorney, i.e. there might be some serious bucks here, and there might be an actual, winnable case. Direct, monetary reward to me aside, however, if–yes, lots of ifs–such a case were to be brought and were to be won and were to force a change in Microsoft’s behavior, that would save me and my clients much future time and agony, which for me would be direct reward enough. Nothing personal to Woody, who’s performing a much-needed service for us, but all in all it would be better if that service were no longer necessary.
GaryK
2 users thanked author for this post.
-
@gkarsik @cybertooth
Please try to keep the subject matter about patching. Lawsuits are a bit off-topic here. 🙂
2 users thanked author for this post.
Viewing 22 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
WWDC 2023: Here’s everything Apple announced this week
by 3 hours, 14 minutes ago
-
Malwarebytes Browser Guard extension in Firefox: where is the MB logo?
by 3 hours, 29 minutes ago
-
Android – or Android muic app – file system
by 6 hours, 46 minutes ago
-
Restore Points Being Deleted
by 10 hours, 41 minutes ago
-
Why millions of usable hard drives are being destroyed
by 4 hours, 1 minute ago
-
YouTube Display is Very Large
by 14 hours, 1 minute ago
-
1Password and passkeys
by 22 hours, 57 minutes ago
-
Macrium user error:selected volume guid?
by 17 hours, 36 minutes ago
-
Windows 11 Insider Preview Build 22621.1835 and 22624.1835 released to BETA
by 1 day, 13 hours ago
-
Unexpected HP Install Request anfter removal of Norton AV
by 1 day, 9 hours ago
-
Will Incontrol stop Windows 11 22H2 update, if used after update is paused?
by 13 hours, 53 minutes ago
-
Restoring a Bitlockered System Image with Macrium Reflect Free
by 1 day, 18 hours ago
-
Prevent emails from ever being seen in Outlook 2013
by 1 day, 14 hours ago
-
Windows Update
by 14 hours, 40 minutes ago
-
Vivaldi 6.1 with Bing chat , browsers mimic
by 13 hours, 43 minutes ago
-
MS-DEFCON 2: Are you still on Windows 10 21H2?
by 13 hours, 28 minutes ago
-
Word 2021 – Print View problems
by 1 day, 19 hours ago
-
Windows 11 Insider Preview build 25387 released to Canary
by 10 hours, 51 minutes ago
-
Windows 11 Insider Preview build 23475 released to DEV
by 2 days, 13 hours ago
-
WordPress added AI – Jetpack
by 2 days, 11 hours ago
-
PXE Boot and Hyper-V virtual machines and other strange things
by 2 days, 16 hours ago
-
Testing for adding table to post
by 2 days, 13 hours ago
-
I honestly can’t tell if this is a scam or not
by 1 day, 10 hours ago
-
New Life For Ten Year Old DIY NAS Hardware
by 16 hours, 6 minutes ago
-
June 2023 Office non-Security updates have been released
by 3 days, 11 hours ago
-
Web Apps from Brave Browser
by 2 days, 10 hours ago
-
Firefox 114 offering Secure DNS Options – does AT&T ISP Support?
by 2 days, 13 hours ago
-
macOS 14 Sonoma
by 2 days, 16 hours ago
-
Just a fyi – I think I’ll skip on an Apple Vision Pro hardware section
by 3 days, 14 hours ago
-
What’s wrong with Windows 11?
by 4 hours, 21 minutes ago
